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In [J.S. Shaari, M. Lucamarini, M.R.B. Waliiddin, Pliys. Lett. A 358 (2006) 85-90] the 
^^ I deterministic six states protocol (6DP) for quantum communication has been developed. 

This protocol is based on three mutually unbiased bases and four encoding operators. Infor- 
»vj ' mation is transmitted between the users via two qubits from different bases. Three attacks 

^^ ' have been studied; namely intercept- resend attack (IRA), double-CNOT attack (2CN0TA) 



and quantum man-in-the-middle attack. In this Letter, we show that the IRA and 2CN0TA 



^pH, are not properly addressed. For instance, we show that the probability of detecting Eve in 

-4— > ' 

^ i the control mode of the IRA is 70% instead of 50% in the previous study. Moreover, in the 

C^ ■ 

^ ' 2CN0TA, Eve can only obtain 50% of the data not all of it as argued earlier. 
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In [l|, the authors have developed the deterministic six states protocol (6DP) for quantum 
communication. This protocol can be briefly explained as follows: We have three bases, namely, 
}_j ■ X, y, z, which are mutually unbiased and have the forms: 

|z+) = |0), |^-) = |1), 

|x±) = (|z+) ± \z+))/V2, \y±) = (|z+) ± i\z+))/V2. 

Bob chooses two qubits from ([T]) on condition that they are from different bases and send them to 
Alice. Alice upon receiving the qubits operates on both of them with one of the four operators 
I,X ,iY or Z according to the message she wants to address to Bob. Then she sends them back to 
Bob. He then measures the qubits in the bases, which they have been prepared earlier, to decode 
the key. The key extraction depends on an advance agreement between the users related to the 
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encoding processes, i.e. / — > 00, X — > 10, iY — > 01, Z — > 11. This scenario makes the GDP 
more secure than the standard BB84 protocol [2]. As we can see, no pubhc discussion is necessary 
for the completion of the encoding-decoding procedure, as it happens in BB84. Moreover, the 
BB84 protocol has a probability of 1/2 that a transmitted bit has to be discarded due to the 
wrong choice of basis on both sides. This is not the case in 6DP, where one of the users knows the 
measurement bases. We proceed, three types of attacks, namely, intercept-resend attack (IRA), 
two control-NOT gates 3|] attack (2CN0TA) and quantum man-in-the-middle attack, have been 
discussed for 6DP in [1]. It has been shown that Eve can obtain 50% of the message by using IRA. 
Also, she can obtain full information from the protocol via 2CN0TA. By means of the quantum 
man-in-the-middle attack Eve either induces two errors in the communication, one for each path, 
or induces no errors at all. This is something that a "natural" noise cannot statistically give. This 
represents a sure signature of Eve's presence [1]. 

In [l|, the treatments of the IRA and the 2CN0TA have been performed when the users use 
two qubits from the same bases (, precisely, identical qubits). This contradicts with the notion of 
the protocol, which is based on two qubits from different bases. Actually, this property is necessary 
to establish the key in the protocol. For instance, assume that Bob sends one particle in the state, 
say, \x^) and after a complete round he receives the particle in the same state. For him, this 
means that Alice used / or X as an encoder and hence the key cannot be extracted. As a result of 
this, we deal again with these two attacks considering two qubits from different bases, as it should 
be. In treating IRA, we consider the permutation of different bases in the protocol. We obtain 
results completely different from the previous ones [1]. For instance, we show that the probability 
of detecting Eve in the control mode of the IRA is 70% instead of 50% in [1]. Additionally, in 
contrast with the analysis given in [1], we show that 2CN0TA is not relevant to be used against 
this protocol. Throughout the investigation we use the same notations and some of the equations 
given in [l[. 

We start the analysis with the IRA for control mode. This can be explained as follows: Bob 
has to prepare two states, say, \Bi,B2) from different bases and sends them to Alice, who returns 
them back to Bob without doing any action on them. Bob checks if Eve is on line or not by 
measuring these qubits using the same bases in which they have been initially prepared. In IRA, 
Eve measures both of the travelling qubits in the forward and in the backward paths in the same 
bases. Suppose that Eve performs projective measurements along the orthogonal bases [1[: 

IXi> = cos(|)|0)+exp(i<^,-)sin(|)|l), Ix^) = expH^^^) sin(|)|0) -cos(|)|l), j = l,2, (2) 
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FIG. 1: The average probability of not detecting Eve during the control mode of the IRA. The angles 9i 
and ipi define Eve's projective measurement direction. The angles are measured in radian. 

where < 9j < vr, < 93^ < 2tt. The index j indicates that Eve can use one or more different 
bases for the measurement. In IRA, the probability that Alice (Bob) does not detect Eve on the 
forward (backward) path equals the probability to obtain the states \Bi,B2) prepared initially by 
Bob. These two partial probabilities are equal and each of which can be expressed as: 



p|Bi,B2> _ p\Bi,B2) _ p 



noEveA 
|2 



iPB2\x2+PB,\xi^B2\xi^ (^) 

1,2 and the subscripts noEvcA and noEves mean that the 



where Pbj\x,, = \{Bj\Xj')r,J,J 
probabilities are related to Alice (forward path) and Bob (backward path), respectively. The 
probability P^gE^^ that Eve is not detected after a whole control run is the product of the two 
partial probabilities, i.e pIoEvs = ^noEveB^noEvei- '^^^^ quantity is quite different from Eq. (5) 
in [1]. Now we study the behavior of PnoEve ^°^ ^^° cases depending on whether Eve measures 
the travelling qubits (, i.e., qubits in the transit) using the projective qubits from the same or 
different bases. The first case (, i.e. j = 1 in ([2])) is given for the sake of comparison with the 
technique used in [1]. Of course this scenario gives Eve complete information on one of the qubits 
and probabilistic information on the other. In spite of this, the results will be sufficient and better 
than the earlier ones [1]. Starting with the first case, from ([1]) and ([2]) the quantities Pb \xi (where 
Xi = X2) can be easily calculated and the average probability of not detecting Eve P in the IRA 




FIG. 2: The average probability of not detecting Eve during the control mode of the IRA. The angles 9i 
and 02 determine Eve's projective measurement direction and (j)j — 0- The angles are measured in radian. 
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P= ^ 

^ 12 



( p\^+,^+) _|_ p\^+,^-) _|_ pk-:a;+> _|_ p\z-,x-) p\z+,y+) p\z+,y-) 
i noEve ' noEve ' noEve ' noEve ' noEve ' noEve 



(4) 



_|_pk->y+> I p\z-,y-) _|_ p\y+,x+) p\y+,x-) p\y-,x+) p\y-,x-) 
' noEve ' noEve ' noEve ' noEve ' noEve ' noEve 



It is worth mentioning that such type of terms, say, Pno^ve ' which include such elements 



noEve ' 



Pg I ±Pb2|x2' i^ implicitly covered in (JH). Precisely, one can prove, e.g., PnoEve 
We plot the relation dU in Fig. 1. Based on this figure one note 0.25 < P ^ 0.28. The case 
P = 0.25 occurs when Eve's projective basis reduces to one of the set given by (1) (see Fig. 1). In 
this respect, all elements in the right hand side of (JH) tend to 1/2, i.e. P^oEve ~ l/^i Vi, je{x,y, z} 
basis. This fact can be analytically checked. Additionally, one can easily realise that the max- 
imum value P ~ 0.28 occurs when Eve's basis is different from those used in the protocol, e.g., 
(0,0) = (7r/2,7r/4). In other words, when Eve measures the two qubits in the same basis she will 
be detected at least by 72%, however, in [1] it was approximately 50%. 

Next, we draw the attention to the second case, in which Eve measures the two travelling qubits 
in two different bases, i.e., j = 1,2 in ([3|). Consequently, Eve could obtain more information than 
that extracted from the single-basis case. In this case the order of the travelling qubits should 
be taken into account, where P^^^ve t^ ^noEve ■ Thus, the expression ([H) includes 24 terms. 
Information about this situation is depicted in Fig. 2 for ipj = 0. From this figure it is obvious 



that there is an improvement in Eve's information but not too much, where 0.25 < P ^ 0.3. 
This means that the probability of detecting Eve is at least 70%. The maximum value P = 0.3 
(minimum value P = 0.25) occurs when Eve's bases reduce to pair (one) of the x, z, y bases. 
The natural question is: Can Eve increase her information about the key by using three different 
bases as those used in the protocol? According to the scenario described above, the answer is no 
since she, in this case, may overcome difficulties in choosing which appropriate projective bases for 
performing the measurement. This may decrease her information compared to those obtained from 
the previous cases. To explain this point, assume that Bob sends two qubits in two different bases 
to Alice. According to above strategy, the probability that Eve measures them in the correct form 
in the forward as well as in the backward paths is 1/12, i.e. in a complete round the probability is 
1/144 ~ 0.007. Finally, we should stress that the IRA cannot allow Eve to ascertain Alice encoding 
with certainty, regardless of the choice of the projection axis. This means that Alice-Eve mutual 
information after the IRA is less than unity. The reason is that Eve in the IRA is going to use 
one or two or three projective bases. In each case, as we discussed above. Eve cannot obtain full 
information about the message. This fact will be elaborated when we discuss the 2CN0TA below. 
We conclude this part by shedding some light on the eavesdropping success probability as a 
function of P. Assume that c is the probability of occurrence the control run. Thus the effective 
transmission rate reads r = 1 — c, which is equal to the probability for a message transfer [^, |5|] . 
The average probability of detecting Eve during a control run equals d = 1 — P, where P is given 
by JH]). Thus, the probability that Eve acquires n bits of full information without being detected 
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l-c(l-d) 

We apply the formula (jS]) for the extreme values in Fig. 1, i.e. P = 0.25 and 0.28, with c = 1/2. In 
this case. Eve has correspondingly probabilities of about 1.1% and 1.3% to successfully eavesdrop 
1 byte (i.e., 8 bits) of information. It is evident that the probabilities are very low. 

Now we draw the attention to the 2CN0TA. In this attack Eve performs a first CNOT (Sj 
between the photons in transit from Bob to Alice (control qubits) and her ancillae (target qubits). 
The second CNOT is performed in the backward path in the same scenario. This attack can give 
Eve full information on the key for some protocols, e.g. [2]. In [1] it has been argued that Eve 
can obtain full information about the 6DP using this attack. This is obvious where the mutual 
entropy between Alice and Eve as well as between Bob and Eve are unity (see (10) in [1]). On 



the contrary, here we prove that the 2CN0T is not an efficient attack against the GDP. This can 
simply be reahzed as follows: Assuming that Eve uses the ancilla \0)e with one of the Bob qubits 
in the forward path. Then in the backward path, Eve measures her ancilla. It can be either in |0)£; 
or in |1)£;. This does not give her definite information about the encoded bits, where Alice could 
execute one of four operations. More illustratively, when Eve obtains |0)£;(|1)£;) this means that 
Alice acted on the qubits by one of the operators I or Z (X or Y). This point was not discussed 
in [1]. Next, we extend this conclusion when Eve uses two ancillae, say, |a)f'|6)|' where a,b = 0, 1. 
According to the notion of the GDP, Bob has to prepare two qubits from two different bases as: 

IV;) = iV^i) ® |^2> = (ai|0)i + /3i|l)i) ® (a2|0)2 + /32|1>2), (6) 

where Oij,(3j are c-numbers, which can be arbitrarily chosen to provide the different forms of the 
states (1) and |ajp + |/3jp = 1. Eve executes her ancillae \a)f\b)2 with the Bob qubits and 
performs the first CNOT as: 

Ucnot{\mo)f\h)^ = l^i) = (ai|0)i|a)f + /3i|l)i|l a)f ) (a2|0)2|6)f + /32|1)2|1 6)f ). (7) 

Alice can act by any one of the four operators given above, say, Lj, to encode both the qubits with 
the value j = or 1. This could change the forms of the coefficients aj,/3j to, say, a'-,/3'. The 
values of a',/3' depend on which operator Alice used in the encoding process. Then we obtain: 

4-|*i) = |*2> = K|j)i|a)f + /3;|1 e j>i|l ® «>f ) ® (a2li>2|6>f + /32|i e i>2|l ® 6>f )• (8) 

Upon returning on the backward path Eve performs the second CNOT as: 

Ucnot\^2) = (a'lli)! + /3l|i ei)i) ® (a'2U)2 + /3^|i e j)2)|j e a)f ij e 6)f . (9) 

From ([9]) it is obvious that the ancillae have been disentangled from the qubits and they are insen- 
sitive of the initial states. Next, Eve measures her ancillae in the z basis to get some information. 
Actually, Eve's information is restricted to her ancillae since she cannot access the travelling qubits 
to see if the initial qubits are flipped or not. This would confuse Eve since different operations 
can give her the same results, as we mentioned above. For instance, assume a, 6 = 0, and Alice 
executed one of the operators I oi Z {X or iY). Thus Eve measurement outcome is |0)f |0)2 
(|l)i 11)2)- Similar conclusions can be quoted for the other values of a,b. Furthermore, these 
results are still valid even when Eve's ancillae comprise different bases, e.g., one of the ancillae in 



z basis and the other in x basis. We have checked this fact. According to this discussion Eve has 
a chance 50% to get the correct result and hence the mutual entropy between different partners 
might be written as: 

tAE _1 tBE _1 tAB _i Mr.\ 

'-2CNOT — 2' ^2CNOT — 9' ^2CNOT — ^- \^^) 



The origin in the last relation in (jlOp is that the 2CN0TA does not perturb the message and 
hence Alice and Bob mutual information amounts always to 1. In other words, in this attack Eve's 
actions do not affect the users outcomes. Comparison between the relation (jlOp given above with 
Eq. (10) in [1] is instructive. 

It is worth mentioning that the analysis of the control sessions for the 2CN0TA is equivalent 
to that of using the identity operator / in the encoding process by Alice in the above analysis. In 
this case, Eve's anncillae do not change after a whole run. This indicates that if the legitimate 
users restrict the encoding operators to / and Z (instead of four). Eve will obtain no information 
about the protocol from the 2CN0TA. In this regard, the protocol is secure against this type of 
attack, however, it may be vulnerable against the others. 

In conclusion, the key extraction in the GDP is based on two qubits from different bases. Con- 
sidering this property we treated the IRA and 2CN0TA in this Comment. The rate of security 
obtained from this treatment is higher than that shown in [1], in which the security analysis was 
evaluated to one-qubit case only. 
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